CVE-2026-77960

MediumCVSS 5.3/10Last modified Sep 18, 2026

Description

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Sep 18, 2026
Last modified
Sep 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-779668.8The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authentiCVE-2026-779678.1The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association witCVE-2026-779688.2A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. WhCVE-2026-77977.5The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL InCVE-2026-779705.9Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generatedCVE-2026-779729.0Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internCVE-2026-779748.0After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware throughCVE-2026-779756.5The affected Ebyte product exports administrative credentials and other sensitive configuration information without adequate protection. CVE-2026-779778.1Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actiCVE-2026-77985.4The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnCVE-2026-779879.8A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer vaCVE-2026-779886.6A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. This vulnerability affects the function nvram_get of the component CLI Conf